2de0e8bfc87c75268fc4dd06971cfa4eaa6ef0703a92b07e8a3d1d78473e2758

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_2159f467a156a355c527f8816dc99375.exe
Size

350KB
MD5

2159f467a156a355c527f8816dc99375
SHA1

41dd19f62208901d4dd454d084382dc408fc0bf1
SHA256

2de0e8bfc87c75268fc4dd06971cfa4eaa6ef0703a92b07e8a3d1d78473e2758
SHA512

14eb7a5bae2f09b7a11682689677d4ad61b83a81c0bb64d880d97cd858147ad5362038b3ccf67a7e3958aa06105e71f81b6cab01b01f5edf527efeabaf468874
SSDEEP

6144:zqjAgHiAy4sYQwxmE8r3M9NQbkN4PYITd/FP1i2/ph80vVy98G2fms7L:zXopy41mEaM9+b3PFNFlhTy98G2eqL

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-sxduh++.Txt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com +)/99*&)!7(8?!6' &15&.!?4%/6>2# ------- +)/99*&)!7(8?!6' &15&.!?4%/6>2# What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? +)/99*&)!7(8?!6' &15&.!?4%/6>2# ------- +)/99*&)!7(8?!6' &15&.!?4%/6>2# It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is possibility to restore them with our help . +)/99*&)!7(8?!6' &15&.!?4%/6>2# ----- +)/99*&)!7(8?!6' &15&.!?4%/6>2# What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. !!! What should you do next ??? +)/99*&)!7(8?!6' &15&.!?4%/6>2# ----- +)/99*&)!7(8?!6' &15&.!?4%/6>2# In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://k47d3.proporr.com/DCC74656A122B45C http://wor4d.slewirk.at/DCC74656A122B45C http://kbv5s.kylepasse.at/DCC74656A122B45C +)/99*&)!7(8?!6' &15&.!?4%/6>2# ----- +)/99*&)!7(8?!6' &15&.!?4%/6>2# If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser Insert link in the address bar - yyhn7fpvq44cqcu3.onion/DCC74656A122B45C +)/99*&)!7(8?!6' &15&.!?4%/6>2#----IMPORTANT*****************INFORMATION---------+)/99*&)!7(8?!6' &15&.!?4%/6>2# Your personal homepages http://k47d3.proporr.com/DCC74656A122B45C http://wor4d.slewirk.at/DCC74656A122B45C http://kbv5s.kylepasse.at/DCC74656A122B45C Your personal homepage Tor-Browser yyhn7fpvq44cqcu3.onion/DCC74656A122B45C Your personal ID DCC74656A122B45C +)/99*&)!7(8?!6' &15&.!?4%/6>2# ----- +)/99*&)!7(8?!6' &15&.!?4%/6>2#

URLs

http://k47d3.proporr.com/DCC74656A122B45C

http://wor4d.slewirk.at/DCC74656A122B45C

http://kbv5s.kylepasse.at/DCC74656A122B45C

http://yyhn7fpvq44cqcu3.onion/DCC74656A122B45C

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Deletes itself 1 IoCs

pid	Process
2640	cmd.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	wfmiedocaocs.exe

Loads dropped DLL 2 IoCs

pid	Process
2452	VirusShare_2159f467a156a355c527f8816dc99375.exe
2452	VirusShare_2159f467a156a355c527f8816dc99375.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hostslertkfvexv = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START \"\" \"C:\\Users\\Admin\\Documents\\wfmiedocaocs.exe\""	wfmiedocaocs.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\7-Zip\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\7-Zip\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\it-IT\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sv\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Services\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\fr-FR\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\-!RecOveR!-sxduh++.Htm	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\-!RecOveR!-sxduh++.Png	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\-!RecOveR!-sxduh++.Txt	wfmiedocaocs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2528	vssadmin.exe
2108	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B435D7B1-2716-11EF-B991-7EEA931DE775} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000080c78c8c918834fbbe12719cf99afed000000000200000000001066000000010000200000002d6257364fc53da84cc31cd5dd0d3c3709a58ecf4d86f83c422044d9226cdee0000000000e8000000002000020000000234af71839a6cb565212a2b8f8992ffa2d08c639adb702de9ad6752bbc4b88ab90000000f75464cc2b83459c0b5eb70d0cfba9a036896b070939d0e6ceec0e85aaa56450f72d843db4c96ece8af1ed7c3c70de785b92447ed7ca3e9a3f420d38cf4be689e40912d04e4f1a005f396a47def878084f8ff1f487512c859ede6a9035318a85ecde38ebc434691bf995a696b2b70e18a8fabc4a3b1c073c29b449729c927cd948e815d966cbd18b564b8634942830cc40000000fc2aec5c1aaa6585c8498c8e8045fe7d50b54db28fdf963c529e59880ba1cc6574e2f5686f0206e219c143ee379a49bedf48ff6e3218f7f255bebe9f34118206	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424178261"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000080c78c8c918834fbbe12719cf99afed0000000002000000000010660000000100002000000073d177bbb8ff5d3fde4ce2e12abfc095fbdd56fd497ce1ee33275d8252ecbc13000000000e8000000002000020000000036f3470e534e0cf42740395c40569d5f2e12a349b0095e9a6aefd8594e9bf27200000009b65b117b7909004befbe9467208060149219315e0a3645b058ecb4d28215a8340000000845c3e152f38abf5c8ff35430aca6ca4c44b2deec090eadc256866142932b05e12b9aea2d4d34d50a92086b53a86e21361876ed7fe2df45ffe16d9b24081e27f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c1af8823bbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe
2664	wfmiedocaocs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	wfmiedocaocs.exe
Token: SeBackupPrivilege	2540	vssvc.exe
Token: SeRestorePrivilege	2540	vssvc.exe
Token: SeAuditPrivilege	2540	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
796	iexplore.exe
3056	DllHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
796	iexplore.exe
796	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2664	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	28
PID 2452 wrote to memory of 2664	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	28
PID 2452 wrote to memory of 2664	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	28
PID 2452 wrote to memory of 2664	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	28
PID 2452 wrote to memory of 2640	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	29
PID 2452 wrote to memory of 2640	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	29
PID 2452 wrote to memory of 2640	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	29
PID 2452 wrote to memory of 2640	2452	VirusShare_2159f467a156a355c527f8816dc99375.exe	29
PID 2664 wrote to memory of 2528	2664	wfmiedocaocs.exe	31
PID 2664 wrote to memory of 2528	2664	wfmiedocaocs.exe	31
PID 2664 wrote to memory of 2528	2664	wfmiedocaocs.exe	31
PID 2664 wrote to memory of 2528	2664	wfmiedocaocs.exe	31
PID 2664 wrote to memory of 592	2664	wfmiedocaocs.exe	39
PID 2664 wrote to memory of 592	2664	wfmiedocaocs.exe	39
PID 2664 wrote to memory of 592	2664	wfmiedocaocs.exe	39
PID 2664 wrote to memory of 592	2664	wfmiedocaocs.exe	39
PID 2664 wrote to memory of 796	2664	wfmiedocaocs.exe	40
PID 2664 wrote to memory of 796	2664	wfmiedocaocs.exe	40
PID 2664 wrote to memory of 796	2664	wfmiedocaocs.exe	40
PID 2664 wrote to memory of 796	2664	wfmiedocaocs.exe	40
PID 2664 wrote to memory of 2108	2664	wfmiedocaocs.exe	41
PID 2664 wrote to memory of 2108	2664	wfmiedocaocs.exe	41
PID 2664 wrote to memory of 2108	2664	wfmiedocaocs.exe	41
PID 2664 wrote to memory of 2108	2664	wfmiedocaocs.exe	41
PID 796 wrote to memory of 2060	796	iexplore.exe	43
PID 796 wrote to memory of 2060	796	iexplore.exe	43
PID 796 wrote to memory of 2060	796	iexplore.exe	43
PID 796 wrote to memory of 2060	796	iexplore.exe	43
PID 2664 wrote to memory of 1692	2664	wfmiedocaocs.exe	45
PID 2664 wrote to memory of 1692	2664	wfmiedocaocs.exe	45
PID 2664 wrote to memory of 1692	2664	wfmiedocaocs.exe	45
PID 2664 wrote to memory of 1692	2664	wfmiedocaocs.exe	45

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	wfmiedocaocs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wfmiedocaocs.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_2159f467a156a355c527f8816dc99375.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_2159f467a156a355c527f8816dc99375.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\Documents\wfmiedocaocs.exe
  C:\Users\Admin\Documents\wfmiedocaocs.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2664
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2528
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\-!RecOveR!-sxduh++.Txt
    3⤵
    PID:592
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\-!RecOveR!-sxduh++.Htm
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2060
- - C:\Windows\System32\vssadmin.exe
    "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\DOCUME~1\WFMIED~1.EXE >> NUL
    3⤵
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:2640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-sxduh++.Htm

Filesize
11KB

MD5
f746fe0d18b08772d3b1b986d405242c

SHA1
b8787f356189233e21bc45973d4194339c713743

SHA256
8a09a843d9f268b49b7886affa704bdb097bbec436a95e4a761a52cf626a772a

SHA512
94c10626c692e711f034ea0dda4d6bda9feb1c20d363f6c029a58b9923e6f09130dcd251f3a79dadced084536731e328d6f0b13487cbb850fe3b646bf84537c4

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-sxduh++.Png

Filesize
76KB

MD5
ade4c4da57eca996c5a874c4ff2a3d40

SHA1
67e01532e27ad881a128dab51c134122d53d2535

SHA256
5be938a715756462f2c2946e8df8472e12c0e490d7ccf883986f22382a2d95ba

SHA512
5093f04421bf7dd1422ec42de1b2baec20ef7a77e06cf37e4dc9a6e57211772e42aab4013abbb3c81877415550b8bbd6c8e2febd575d7cace9bd8252cbc40f59

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-sxduh++.Txt

Filesize
2KB

MD5
d68f0dfc21c4e968d45ee6806d6cc51d

SHA1
14a3f8da5e45a9179df0773e49e23a49bb4e498f

SHA256
cfbfd236e7ffd9607af7f21a81168a5f34200ec041a4134e9cb8f4fafeb3b665

SHA512
626468e3f451ec4cfb40d03d9f9da7644de58d0a4a6723895cc3f7db35690d61d2f561a08408f1faa960d5710d6226debb0684e56239ba4d14a06e7dd3731765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83db36a1fe2e823c184f6f05e250dac6

SHA1
8d7678facc0f08b4f7cf4ae8c9ba27b3605f1744

SHA256
a217ad00e9b1a304197885cfa150bedc11ef84199347a54f5ea335dddaf1cf85

SHA512
0adae9e494f63720502132038908ee47d6679853abd28941134bfc3e6b6f187d795c8c1e7e0272d18bd224732661022ddff375608cc584a2aef4553928bb5d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68508439f0ce7b9cf1e13f45fb379881

SHA1
901bfd364a39af12ed4f9250c018c8989cbd7510

SHA256
12d9be98c429c0bdb15aa1e1b0ec0e21c08b175d5f468221876be0d917a8a5a9

SHA512
491a8896859e4d516ca3dc4d035244620d07ccbc945f974781f417d1c5d4318ba84d858390aac917755793283012b5a8ab256d3d499e3a681f5b55c1bee9a3d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8360d124277d3aa5d84bc14ccfdcd9b1

SHA1
6b3356943a52c796c0e249b2f560ace0ed61552e

SHA256
f5c8cca0940a5375f0e87614c0c6af7866fdb426d49caf80ed168f4c99242ca0

SHA512
b7e8cf8dcee2336add2c0fb6a7c88cb2e3a490dd247366a2ae52f0b0a1b06b651176ce0944417fafbb8bf324e1393975bb337e32bf3d9a11729831983f8cf743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
906dad4a6f6b64f886ce9c92d32c530f

SHA1
519cb805caaa9a291a7657e38106652f51b39093

SHA256
1585716909980f58c2fe7feb2dc97feca013960b8f8dfd2044d9ff0800c56752

SHA512
fd9998e65b8a10e34145e02f6702ca76aaa87a6e0eeeb3884ebff1ffc22398f60bfeb048530c7542bbcc131ab473591413d24f9247e6cb730fb2f67790af21d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18c0a54e406ea9a428c5d68f137e51b6

SHA1
01c97ee21d6f4903c772b7694420506b8b54f629

SHA256
0ed0bc54f16a22457002261d59ce035a868235e13b0951a53ec409fb105de495

SHA512
edff83a7f9780b39cb4c8e3f7945739816a524557774a7b2cdd49398cfdf8e93264704d4bebe6065f4de2557a67a9fa76f9163fea4f5d3d92ececff24a9d2e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c44b5f67121187537b439f4b440980da

SHA1
b5858fb9c3c8a63a3d53390c4fa76b069d9e8ff8

SHA256
bdd279ce8a1958380dac41e428979afd4eee27042c488fe38c9e537afbcae242

SHA512
0aef16cbae15c110a34099c8490fa9f6ffb5d20ec80207cb5665d59c7cb1fffbd2f69fa3ed275602aa899eab3c8a47919d326b273647663f115b96f0302dd3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7f8e9e5906013ace9b93c3e73bfd510

SHA1
9e54f13a7d1cebd8b0908cc6e63c59a96c2125cd

SHA256
8f3092394d4b7338bd43bb4fec1b583c913b5e5f394d1e4e9f9e7afcbbcfd64b

SHA512
cffe5def4fe13f0e4c2d3e5be6cc18d82d4209e93f86ece359075ff0ca5c5e0ecb6ac6677d8e21766cc3d8533c02b2728eb99106121ef208f1cbc24539bfc1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61168b20b03aedfa84086aadde8c5467

SHA1
ed3d8975b0913ed35b83bf091ed3cdd77ecf615f

SHA256
4c86d47dbc706150f584843d2f285b8237435e7dc2562759eafce6ed035b7b3a

SHA512
57233aa767658e8bfb5a0be85acf7aca68de4a2077733ec15ec432987d35bd7abb4964b297b9c62895202cad891ac68c8841257a7097029f2acef39da7b699ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c15c554001fad25d5674be67a86eaa0

SHA1
14051a049b3f51ce1744d11b92bea030ae3187ac

SHA256
b7cd66468899debfb427da6d137a5420467d58d00ae1dc5ca43f0bd00359f317

SHA512
d4044ffb604e22c077468d3ef03925dfdc71330e2c7284f47637ffa720667394003e59973d3914a523a67df4f26fbc086d36f6dc5b9ab97c27dde5e6cd9a8af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3afe510ab19f640a6cb06877d9185c74

SHA1
4809eb53e77f8233c42698e8f3508c48758a4c27

SHA256
232b8b9ca3f0bac9b2b1bd44b1d054048561060d913b89215d110944cd4055b1

SHA512
9544c3f6c65339ac45a8208c15b8e9d2d538c1282d6debcc811b10fbb81ddea8824936f1b96d28d63c63789593bc88ee5484d14bc5d2491fda1440753b481946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5830fdd53fa5ac7a89ea525ca7e320ba

SHA1
30c940c24247108449a166a7d4f30af92cb849a0

SHA256
25d48444e8623b6e7569be964de284efd6d19e5a8ff1e07930c5d016cce9f4fe

SHA512
a8e0213c31caf072fc750f5a572a6befed6448287c47d7d31931d9565f33b7c7b3ae9da6e650261686f6b6ab04c68ea24f749cb87c4a82e826fbe10a8041ab3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21dbaf69ec426d1004ad0402de3e7437

SHA1
63c633833d2f1d3af870cf95cdd1cdc35a14ae58

SHA256
3beb875343ad55123fc6987d3f09158e9f9d5bd78acd0b880d16bee7988e507f

SHA512
6502393378cb108f17cc62bd0b2148d83b728d3b86dad1ea930252bd155c9809806ee4973f6c040cbffc1dc86eb78d1918a321abad7e2196d36c3de001f1d24d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9841f2b1824668de62674dba18021137

SHA1
5822fc11f510cf983ac8a50ddc78664e13401c08

SHA256
b01a6dc590ddabc44633e419a28fd70926c40c8de731fb6e38697a4dfbd6713c

SHA512
c9bb48abc218ce1ea612734569ba1d4e61e1234335fd30e1c4d9e7e0bbb5247869b52f77f196cdc3be44090de877284898271fad1aca7e01107a774d951801dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b2d63b99c4acc145f619dcff5e4ee7f

SHA1
55075f18b9b6e631db7aac08b4437a25590ab750

SHA256
564bac503b6a9065faa4e2ec2add1c991236459f9fb4deaf20b4f8d3e927a7d3

SHA512
4db0c97c4149123ac38b0c9a6056d1f2b53b2822c6c3311cd68dd615434881bdd84696df72a662e158753fc42d421bc7f5e5236fe51515b7856b5162b3f6645a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbc00e1709d75662e644cd93d4d426b8

SHA1
d5e72639ba471f3b0d2a15226cf53cf81c9971e1

SHA256
1bc2b1fc859bf01de459e47379abbcf62f2e14aa93854a27726b395fbf2acb7c

SHA512
7eb7f6e3188c799b2c02509a609c7ba21823a66103908152ea712cea6b023bc5c15193195a08c3448e47d7518d47fbcaf341d6227373c764f32bc9b88229cf4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d0bfc3bc52d5a60f8420b70c785a34

SHA1
419d479bc7f49882c3878d0276e93caae8999d3e

SHA256
9e0184b971da328a4642e65d93be19b823cf88aed228a97863f30991e0d25ec9

SHA512
0b1aac8f8a2e3d857cf3d0f768e54bfbba730e526b04cd0c3b36fd52121831e73a9c494802d7be1907e09241c8efebfdc14c4d2bdbb75fa3b7294ed09e830362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca559ee9954b940f91ae4c834e178696

SHA1
3d79b800b05c4c292ce416ffb08bd7a9edac1995

SHA256
f82a509c0b1c6bc02579aa41c3d53aca685f32c660cc0004d157c492ed600f83

SHA512
b7a4e5cba4136be6ede852724af4a2e1c7ae8724373b0f27ee0c1c268fce327696055a5fdb6d0e5c0b63253cb483fabbc1c250ed7ea300e3a821cb2297619ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa84d67192831ade7062e99070bcad43

SHA1
88ec4f845bae3272fc66f88b480e0aa8ac8e5c95

SHA256
c47a1f3c88a9c30638b6ce9529846ad7b32f2bfceba62840a958089608e7ad88

SHA512
6c243c8b121f4566b1506431c00a16057f90e0836bfbc94f81655f1e48e0870dd5491faed6bc9106aab645297da4d7d11ae82d683aa43c3366c7d7a5daccd0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aeac163aff3c8f9bac914c1dec0370b

SHA1
a7d8e4e6ea69ae0de5935e867abd6a52a240f810

SHA256
84a4c0b7c89f03175a021f737b73c4ca3d15c2398532dd2bdf0faf48f9dd1ea0

SHA512
20fa7eef1de62fc8f39fdb16498c5078acd360a852594bb79e16957697e79762f69c529d2e969d1e487e3ba2e54da18bbce745911edc521be386770e8433cbbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76328ab8816d988cd036fb0e6e1425c5

SHA1
d03401427f0719f984f20a32bd234032d81196e3

SHA256
161c8fe2e6b8428af65c41dc6ded38c0e21974998630bfd66522096e9e14d57e

SHA512
e785d25ced9ce7bdb7d4a3c231c01d2754af7da03589bbbf54a22eaf343635b395173b7a587873a0a9af71f086bb2f4408eae396505e376cfe6053fd3bb6a07b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d948fd923c995c69c1475befac3f9c

SHA1
dda765693c2d0b85f403db4ca19de6f287d90193

SHA256
26522c4979c3d044784b0ee475d0bc028c788b9b78fbf17594b8a4a1e31885a5

SHA512
98915114c0ef51ed2a48ec1a5fca7c7bc04110d7752b80b9fc44374595b8427eec1361a06ac2ef718f25f7ffdc1e0160f3221357cebeca860ec944a6dd4474c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02bc6ba5e6fd1163468b9ec2591bbe63

SHA1
942d921015dfc31b22408fe71df0c0388fe63b8e

SHA256
4988e354ee127c68278af1a1f2bd9bf54c86f859d0b6516bd366e793a76222d8

SHA512
77bde0c559d1cf29902c04da85b19952bbcf24ec8cea00d4f1b773b98b40b28b429a4f5d5e8fd679262fde32346a4f13a9f1346f37265ca9d1e38cffd20b7cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C22.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\CheckpointComplete.jpeg

Filesize
797KB

MD5
6272badeb6102e54f2ceaeb8df67b113

SHA1
f12710ac8c630a49fc82ea55a31f5259d1452d27

SHA256
4c7b27d1136a4f25e717a6a9e80a6112e54aec32390302ad76acce4332ea50fd

SHA512
382895308d0713b5d58fa59cf87e5d9b230bef72e445a4b9e319d587c6972fd92bfaaa2f47730d8f08d8603391d3f708b7cb7478fdc63aa1ef3c7172ac8b66a0

Download Submit
\Users\Admin\Documents\wfmiedocaocs.exe

Filesize
350KB

MD5
2159f467a156a355c527f8816dc99375

SHA1
41dd19f62208901d4dd454d084382dc408fc0bf1

SHA256
2de0e8bfc87c75268fc4dd06971cfa4eaa6ef0703a92b07e8a3d1d78473e2758

SHA512
14eb7a5bae2f09b7a11682689677d4ad61b83a81c0bb64d880d97cd858147ad5362038b3ccf67a7e3958aa06105e71f81b6cab01b01f5edf527efeabaf468874

Download Submit
memory/2452-0-0x0000000000510000-0x0000000000599000-memory.dmp

Filesize
548KB

Download
memory/2452-1-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2452-16-0x0000000000510000-0x0000000000599000-memory.dmp

Filesize
548KB

Download
memory/2452-12-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2664-6011-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2664-5526-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2664-15-0x0000000000360000-0x00000000003E9000-memory.dmp

Filesize
548KB

Download
memory/2664-1763-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2664-4263-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2664-4964-0x0000000000360000-0x00000000003E9000-memory.dmp

Filesize
548KB

Download
memory/2664-5517-0x0000000003900000-0x0000000003902000-memory.dmp

Filesize
8KB

Download
memory/3056-5518-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download